AOH :: HP Unsorted D :: BU-1591.HTM

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability



DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability
DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability



Title
-----
DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability

Severity
--------
Medium

Date Discovered
---------------
November 19, 2009

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
Credit: Rob Kraus, Chris Graham and r@b13$

Vulnerability Description
-------------------------
The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL Injection. Exploitation of the vulnerability may allow attackers to bypass authentication and access sensitive information stored on the device.

Solution Description
--------------------
A patch is not available at this time. Possible workarounds include disabling the vulnerable service, or limiting access to a set of trusted IP addresses.

Tested Systems / Software 
-------------------------
F2L-3000 version 4.0.0 is the only platform that has been manually tested. Earlier versions and other, similar models may also be vulnerable as the platform is sold in various configurations.

Vendor Contact
--------------
Vendor Website: http://www.files2links.com/ 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.